sgdk-combat

SUSPICIOUS. The skill's combat-engineering scope is internally consistent and it does not seek credentials or unrelated access, but it depends on an unverified third-party Docker image (`ewrogers/sgdk:latest`) rather than an upstream-documented SGDK distribution path. That supply-chain trust gap is disproportionate enough to make the skill high risk even without evidence of active exfiltration or confirmed malicious intent.